The Checkmarx GitHub supply-chain 2026 data breach was a connected incident in which credentials obtained through the attack on the Trivy security scanner enabled unauthorized access to Checkmarx GitHub repositories, repository-data exfiltration, and malicious changes to certain developer artifacts distributed through external channels. Checkmarx's completed investigation says access occurred on March 19, 2026, the incident was identified on March 23, and data was exfiltrated on March 30.
The company confirmed that a cybercriminal group published data related to Checkmarx on the dark web on April 25 and that the data originated from its GitHub repositories. The exact repository content types and a unique person total were not published. Checkmarx said it does not ordinarily store customer data in those repositories, so pwnCount and totalRecords remain zero as unknown.
How Was the Incident Confirmed?
Checkmarx's consolidated incident page, updated July 6, says the Mandiant-supported investigation and security-hardening work were complete and the incident fully contained. Its official timeline directly connects the initial access, malicious artifacts, March 30 exfiltration, April 25 publication, and later response steps as parts of the same incident.
BleepingComputer independently reported on April 28 that Checkmarx had confirmed the published data belonged to the company and originated from a private GitHub repository. The report said it observed a 96 GB package but had not examined its contents. LeakData does not convert that observation into a unique record count, number of people, or company-verified data volume; the official scope governs.
How Did the Trivy Path Provide Access?
According to Checkmarx, the incident originated with the Trivy supply-chain attack attributed to TeamPCP. On March 19, malicious Trivy components harvested credentials from downstream users, and attackers used those credentials to enter the Checkmarx GitHub environment. The company identified unauthorized access on March 23, but compromised or cached credentials enabled later activity.
GitHub access allowed the attackers to interact with repositories and publish malicious code through certain external distribution channels. Checkmarx revoked publishing permissions, rotated credentials, blocked outbound access to attacker infrastructure, and locked affected repositories. It notified law enforcement and relevant authorities and retained Mandiant for forensic support.
What Data Was Exfiltrated?
The confirmed data class is repository data exfiltrated from Checkmarx GitHub repositories. The company did not publicly provide a detailed inventory dividing the content into source code, configuration, documentation, credentials, or other files. Exfiltration on March 30 and publication on April 25 are confirmed, but the final official update did not quantify package size or internal file categories.
Checkmarx said its GitHub repositories are separate from the customer production environment and that customer data is not stored there as standard practice. The completed Mandiant review confirmed there was no threat-actor access to Checkmarx One SaaS and that the AWS production environment was not impacted. Customer source code, scan results, and SaaS data are therefore not data classes in this record.
Which Developer Artifacts Were Affected?
The official summary says malicious GitHub Actions and VS Code extensions on Open VSX were published during the March wave. A second wave on April 22 affected identified versions of Checkmarx KICS Docker images, the Checkmarx AST GitHub Action, and the AST Results and Developer Assist extensions on VS Code and Open VSX. Previously published known-safe versions were not overwritten, and risk was limited to defined publication windows.
On May 9, an external service account published a modified Checkmarx Jenkins AST plugin to the Jenkins Marketplace; the company supplied clean releases and hashes. These supply-chain effects mean tokens, keys, configuration files, or other secrets could have been stolen from third-party developer environments that ran affected artifacts. Checkmarx did not publish a verified total of downloads or actually compromised downstream environments.
Were Production and Customer Environments Affected?
Mandiant's final findings limited threat-actor activity to the Checkmarx GitHub environment, a limited number of infected workstations, and initial reconnaissance of Checkmarx AWS credentials. The AWS production environment was unaffected, there was no access to Checkmarx One SaaS, and malicious code was removed from the GitHub environment. The last observed activity inside Checkmarx was April 22.
The CxSAST on-premises product and installer were not compromised; the risk involved externally distributed components. Organizations that executed an affected artifact during its published window still needed to inspect their own environments, hunt for indicators, and rotate secrets when compromise was suspected. This record confirms Checkmarx's corporate data breach but does not claim every Checkmarx customer automatically suffered a breach.
How Should This LeakData Record Be Read?
The breachDate is March 19, 2026, when Checkmarx's final summary says unauthorized GitHub access occurred; March 23 was detection, March 30 was data exfiltration, and April 25 was publication. The verified stolen data is Github repository data. Malicious developer artifacts are described as the downstream supply-chain impact of the same root access.
Zero values for pwnCount and totalRecords do not mean the event was small or harmless; no unique person or record count was published. The LAPSUS$ attribution and 96 GB package figure appear in independent reporting but were not adopted by Checkmarx as a definitive data class or person total, so they are excluded from numeric fields. Customer production data and Checkmarx One SaaS remain outside the confirmed scope.
